58acf9d911
the policy_lock parameter is a one way switch that prevents policy from being further modified. Unfortunately some of the module parameters can effectively modify policy by turning off enforcement. split policy_admin_capable into a view check and a full admin check, and update the admin check to test the policy_lock parameter. Signed-off-by: John Johansen <john.johansen@canonical.com> |
||
|---|---|---|
| .. | ||
| apparmor.h | ||
| apparmorfs.h | ||
| audit.h | ||
| capability.h | ||
| context.h | ||
| crypto.h | ||
| domain.h | ||
| file.h | ||
| ipc.h | ||
| match.h | ||
| path.h | ||
| policy.h | ||
| policy_unpack.h | ||
| procattr.h | ||
| resource.h | ||
| sid.h | ||